How to remove ICE virus

ICE virus – a type of malware  that prevents users from accessing their computers or phones

ICE virus, otherwise known as the ICE Cyber Crimes Center virus, is a computer infection that uses scare tactics in order to make victims pay the demanded sum of money to cybercriminals. There are a few variations of the scam, but most of the time, users are accused of such heinous crimes as view pornography involving children or copyright infringement, both of which could result in jail time. Since the ICE virus locks the screen and pretends to come from a federal law enforcement agency, some users are sent into panic mode immediately.

Users are asked to pay a “fine” of up to $400 via MoneyPak or MoneyGram systems, which allow threat actors to remain anonymous. When dealing with ICE Cyber Crimes Center or a similar scam,  users should remember that no law enforcement agencies would lock their PC screen, regardless if they actually are guilty of some type of crime (different procedures are followed in such case). ICE virus is specifically crafted to abuse human psychology and make significant sums of money in illegal ways.

While the malware might be called ransomware, it is more likely to be its predecessor, as it does not lock personal files, and the lock screen feature is removed as soon as ICE virus removal is performed. However, many users might not know how to access their computers once their screen becomes locked, although Safe Mode always bypasses the feature. 

The ICE Cyber Crime Center virus gains access to computers in various ways, including:

• spam email attachments;
• fake updates;
• exploits and vulnerabilities;^[1]
• software cracks;
• web injects, etc.

Note that malware not only targets Windows systems but can often be encountered on Android phones and tablets – a very typical FBI virus behavior. In most cases, users infect their portable devices when they decide to download apps from shady third-party sources.

Once inside the system, the Cyber Crime Center virus will change the way Windows operates, making it load the scam message each time the OS is booted. For that, malware alters the registry, boot sequence, and other vital files. In some cases, it might also prevent users from users System Restore function.

When it comes to the ICE Cyber Crime Center scam itself, users are hit with a lengthy text, which tries to accuse them of various crimes, such as the use of unlicensed software, illegal pornography, terrorism, cybercrimes, and much more. Threat actors also bothered to write down article numbers and punishments related to each of the alleged crimes and claim that the message is written by the Department of Homeland Security ICE Cyber Crime Center Unit.

During the infection routine, the ICE virus also hijacks a video camera if such is available – this is another trick to make users believe that the law authority is filming them. In other words, cybercriminals use all types of scare tactics to make victims deliver the alleged “fine” via shady ways. Please do not give in to  ICE Cyber Crime Center scam, as you will lose your money and feed criminals' illegal business.

Unfortunately, the scare tactics sometimes work, and victims decide to pay criminals the sum of money they are asking for. However, this will not unlock their computers, as Ice virus removal tool is needed for that. There are several anti-malware solutions available that would recognize and remove Cyber Crimes Center virus from the system with no problems.

However, since the Task Manager or any other functions cannot be used due to malware functionality, the affected users should access Safe Mode with Networking as explained below and then perform a full system scan from there. In case your Windows does not operate appropriately even after malware termination, remove virus damage with the help of FortectIntego and fix your computer.

Malware can be distributed in various ways – learn to protect your computer from it

While some threat actors pick a single way to distribute malware, other groups rely on multiple attack vectors to achieve maximum profits – the latter is more common for malware-as-a-service^[2] scheme-operating criminals. However, this does not make any difference for regular users, as their computers get in trouble if they do not apply the correct measures to protect them from malware in the first place.

Security experts from novirus.uk^[3] have listed the most common screen-locking malware distribution methods. Here they are, and also tips on how to avoid the infection:

• Never open spam email attachments that ask you to run macro function (“Allow Content”);
• Scan the attachment with anti-malware software/ upload to Virus Total if you are not sure;
• Hover the mouse over a suspicious hyperlink on a suspicious website or an email – this will allow you to view the real URL you will be redirected to in the corner of the screen;
• Employ reputable anti-malware software and keep it updated;
• Update Windows and all other installed programs as soon as security patches come out; set the updates to be applied automatically within application settings;
• Never download high-risk applications, such as software cracks or pirated program installers;
• Use third-party tools like ad-blockers for safe web browsing.

Remove ICE virus from your machine

Even those who instantly detect deception might be baffled when it comes to ICE virus removal due to screen locking functionality. Therefore, the only way to bypass this feature is to access Safe Mode with Networking as explained below – Windows is loaded with an only a minimum number of drivers and other resources that are necessary for the boot to be successful. This temporarily disables malware functionality and removes the locks screen, although victims need to remove ICE Cyber Crimes Center virus in order to regain access to normal Windows functions once in normal mode again.

To remove ICE virus, you should use a reputable anti-malware tool such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes – download it and place it into a bootable USB drive. Then, access Safe Mode as explained below, boot from the USB, and perform a full system scan. Note that users infected with ransomware viruses are allowed to access other accounts on their Windows systems. If one such account has administrator rights, you should be capable of launching the anti-malware program.